PillPack LLC
bd_df54afb8ab1dd14b · schema v1 · pii pii-v1
Full breach record for PillPack LLC →PillPack LLC notified Montana residents of unauthorized access to 19,032 customer accounts between April 2-6, 2023. Attackers used stolen credentials (email/password) to access accounts. Data exposed included email addresses, prescription information, and prescribing provider contact details. No SSN or payment card data was involved. PillPack reset passwords and enabled MFA.
J jump to incidentP pin to compareR raw source
Incident timeline
Apr 2, 2023
Begins
Apr 3, 2023
Discovered
May 19, 2023
Filed
vs. sector median
6 wks faster
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- HHS OCRbd_eda3d9e508e9bc7c2023-05-19Verified
- Illinois State AGbd_ac3b93090cc4e1f32023-01-01 · +138dCandidate
Filing propagation · 3 filings · 3 states
View merged incident ↗Pattern: first filing Jan 1 (IL), last May 19 (MT) — a 138-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.